One senior advisor, direct access, no new tooling required.

How an engagement starts

• A direct conversation about what actually needs reviewing, and why now.
• Scope and pricing set out afterwards in a statement of work matched to that conversation, not a standard package.
• Delivery, followed by a briefing session with whichever audiences need the findings.
• Ad hoc questions that do not need a full engagement are billed hourly instead of requiring a new statement of work each time.

What the review draws on

Assessment works from what already exists: network and system diagrams, logs already being collected, and either read-only access to firewalls, identity platforms, and endpoint tools directly, or configuration already exported from them, whichever the client prefers. Where existing evidence does not answer a specific question, free and open-source scripts validate a configuration directly rather than triggering a new tooling purchase. Nothing proprietary gets installed to produce a finding.

Where AI fits, and where it doesn't

A large language model describes a vulnerability that does not exist, or misses one that does, with the same tone of certainty either way. That is why AI never signs off a finding at NZCAT. It drafts report structure, summarises what a scan already found, and flags patterns worth a second look, checked against the actual environment by an advisor whose judgement comes from years of experience across defence, global consultancy, and Aotearoa New Zealand's own regulatory environment.

Direct access, not account layers

Findings go directly from the person who found them to the person deciding what to do about them. There is no account manager relaying context secondhand, and no junior analyst producing a draft a senior reviewer skims before it ships. The person reviewing the environment is the same person in the room for the briefing.